Redmine

gem "argon2id", "~> 0.10.0"

      user.rehash_password(password) if user.password_hash_outdated?

    return auth_source.authenticate(self.login, clear_password) if auth_source_id.present?

    algorithm = password_hash_algorithm

    return false unless algorithm

    algorithm.verify_password(clear_password, salt, hashed_password)

  # Computes salt and hashed_password for +clear_password+ with the configured

  # password hash algorithm, see Redmine::PasswordHash

    self.salt, self.hashed_password = Redmine::PasswordHash.current_algorithm.digest_password(clear_password)

  # Returns true if hashed_password was not computed with the configured

  # password hash algorithm

  def password_hash_outdated?

    return false if auth_source_id.present? || hashed_password.blank?

    Redmine::PasswordHash.current_algorithm != password_hash_algorithm

  end

  # Returns the algorithm that hashed hashed_password, or nil if the password

  # is blank or hashed with an unknown algorithm

  def password_hash_algorithm = Redmine::PasswordHash.algorithm_for(hashed_password)

  # Rehashes +clear_password+ with the configured password hash algorithm

  # without changing passwd_changed_on nor invalidating the user's tokens

  def rehash_password(clear_password)

    salt, hashed_password = Redmine::PasswordHash.current_algorithm.digest_password(clear_password)

    update_columns(salt:, hashed_password:)

  end

  # Algorithm used to hash the passwords of the users authenticated by

  # Redmine itself: sha1 (default) or argon2id.

  # Passwords hashed with either algorithm can be verified whatever this

  # setting is. When a user logs in, their password is rehashed with the

  # algorithm set here if it was hashed with the other one.

  #

  #password_hash_algorithm: argon2id

class ChangeUsersHashedPasswordLimit < ActiveRecord::Migration[8.1]

  def up

    # Argon2id hashes in the PHC string format are longer than SHA1 hex digests

    change_column :users, :hashed_password, :string, limit: 255, default: '', null: false

  end

  def down

    # Argon2id hashes do not fit in 40 characters

    count = User.where('hashed_password LIKE ?', '$argon2id$%').count

    if count > 0

      raise ActiveRecord::IrreversibleMigration,

            "#{count} user(s) have passwords hashed with Argon2id, reset them with SHA1 first"

    end

    change_column :users, :hashed_password, :string, limit: 40, default: '', null: false

  end

end

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

module Redmine

  # Hashes and verifies the passwords of the users authenticated by Redmine

  # itself. New passwords are hashed with the algorithm given by the

  # password_hash_algorithm setting of config/configuration.yml, and

  # passwords hashed with any of ALGORITHMS can be verified.

  module PasswordHash

    algorithm_names = [

      # Order of strength

      :argon2id,

      :sha1,

    ]

    ALGORITHMS = algorithm_names.each.with_object({}) do |name, h|

      h[name] = Redmine::PasswordHash.const_get(name.to_s.camelize)

    end

    class << self

      # Returns the algorithm given by the password_hash_algorithm setting

      def current_algorithm

        name = Redmine::Configuration['password_hash_algorithm'].presence&.to_sym || :sha1

        ALGORITHMS[name] || raise(ArgumentError, "Unsupported password hash algorithm: name=#{name}")

      end

      # Returns the algorithm that hashed +hashed_password+, or nil

      def algorithm_for(hashed_password)

        ALGORITHMS.values.find {|algorithm| algorithm.match?(hashed_password)}

      end

    end

  end

end

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

module Redmine

  module PasswordHash

    # Stores the PHC string format (e.g. "$argon2id$v=19$m=...") that includes

    # the salt and the parameters, so the salt is left blank

    module Argon2id

      class << self

        def match?(hashed_password) = hashed_password.to_s.start_with?('$argon2id$')

        # Returns [salt, hashed_password] for +clear_password+

        def digest_password(clear_password)

          [nil, ::Argon2id::Password.create(clear_password.to_s).to_s]

        end

        # Returns true if +clear_password+ matches +hashed_password+

        def verify_password(clear_password, salt, hashed_password)

          ::Argon2id::Password.new(hashed_password).is_password?(clear_password.to_s)

        rescue ArgumentError, ::Argon2id::Error

          false

        end

      end

    end

  end

end

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

module Redmine

  module PasswordHash

    # Stores SHA1(salt + SHA1(password)) as a hex string with a random salt

    module Sha1

      class << self

        def match?(hashed_password) = /\A\h{40}\z/.match?(hashed_password.to_s)

        # Returns [salt, hashed_password] for +clear_password+

        def digest_password(clear_password)

          salt = Redmine::Utils.random_hex(16)

          [salt, hash("#{salt}#{hash(clear_password)}")]

        end

        # Returns true if +clear_password+ matches +hashed_password+

        def verify_password(clear_password, salt, hashed_password)

          hash("#{salt}#{hash(clear_password)}") == hashed_password

        end

        private

        def hash(value)

          Digest::SHA1.hexdigest(value || '')

        end

      end

    end

  end

end

  def test_login_should_rehash_sha1_password_with_argon2id

    Redmine::Configuration.with 'password_hash_algorithm' => 'argon2id' do

      post :login, params: {username: 'jsmith', password: 'jsmith'}

      assert_redirected_to '/my/page'

    end

    assert Redmine::PasswordHash::Argon2id.match?(User.find(2).hashed_password)

  end

  def test_login_should_rehash_argon2id_password_with_sha1

    hash_password_with :argon2id, User.find(2), 'jsmith'

    Redmine::Configuration.with 'password_hash_algorithm' => 'sha1' do

      post :login, params: {username: 'jsmith', password: 'jsmith'}

      assert_redirected_to '/my/page'

    end

    assert Redmine::PasswordHash::Sha1.match?(User.find(2).hashed_password)

  end

  def test_login_with_argon2id_password

    hash_password_with :argon2id, User.find(2), 'jsmith'

    hashed_password = User.find(2).hashed_password

    Redmine::Configuration.with 'password_hash_algorithm' => 'argon2id' do

      post :login, params: {username: 'jsmith', password: 'jsmith'}

      assert_redirected_to '/my/page'

    end

    assert_equal hashed_password, User.find(2).hashed_password

  end

  def test_login_with_wrong_password_should_not_rehash_password

    hashed_password = User.find(2).hashed_password

    Redmine::Configuration.with 'password_hash_algorithm' => 'argon2id' do

      post :login, params: {username: 'jsmith', password: 'bad'}

      assert_response :success

      assert_select 'div.flash.error', text: /Invalid user or password/

    end

    assert_equal hashed_password, User.find(2).hashed_password

  end

  def test_post_lost_password_with_token_should_hash_password_with_configured_algorithm

    user = User.find(2)

    token = Token.create!(action: 'recovery', user:)

    Redmine::Configuration.with 'password_hash_algorithm' => 'argon2id' do

      post(

        :lost_password,

        params: {

          token: token.value,

          new_password: 'newpass123',

          new_password_confirmation: 'newpass123'

        }

      )

      assert_redirected_to '/login'

    end

    user.reload

    assert Redmine::PasswordHash::Argon2id.match?(user.hashed_password)

    assert user.check_password?('newpass123')

  end

  def test_update_password_should_hash_password_with_configured_algorithm

    Redmine::Configuration.with 'password_hash_algorithm' => 'argon2id' do

      post(

        :password,

        params: {

          password: 'jsmith',

          new_password: 'secret123',

          new_password_confirmation: 'secret123'

        }

      )

      assert_redirected_to '/my/account'

    end

    user = User.find(2)

    assert Redmine::PasswordHash::Argon2id.match?(user.hashed_password)

    assert user.check_password?('secret123')

  end

  def test_update_password_with_argon2id_password

    hash_password_with :argon2id, User.find(2), 'jsmith'

    post(

      :password,

      params: {

        password: 'jsmith',

        new_password: 'secret123',

        new_password_confirmation: 'secret123'

      }

    )

    assert_redirected_to '/my/account'

    assert User.try_to_login('jsmith', 'secret123')

  end

  def test_update_password_with_wrong_argon2id_password

    hash_password_with :argon2id, User.find(2), 'jsmith'

    post(

      :password,

      params: {

        password: 'wrongpassword',

        new_password: 'secret123',

        new_password_confirmation: 'secret123'

      }

    )

    assert_response :success

    assert_equal 'Wrong password', flash[:error]

    assert User.try_to_login('jsmith', 'jsmith')

  end

  def test_create_should_hash_password_with_configured_algorithm

    Redmine::Configuration.with 'password_hash_algorithm' => 'argon2id' do

      assert_difference 'User.count' do

        post :create, params: {

          user: {

            firstname: 'John',

            lastname: 'Doe',

            login: 'jdoe',

            password: 'secret123',

            password_confirmation: 'secret123',

            mail: 'jdoe@gmail.com',

            mail_notification: 'none'

          }

        }

      end

    end

    user = User.find_by_login('jdoe')

    assert Redmine::PasswordHash::Argon2id.match?(user.hashed_password)

    assert_nil user.salt

    assert user.check_password?('secret123')

  end

  def test_update_with_password_change_should_hash_password_with_configured_algorithm

    Redmine::Configuration.with 'password_hash_algorithm' => 'argon2id' do

      put :update, params: {

        id: 2,

        user: {password: 'newpass123', password_confirmation: 'newpass123'}

      }

      assert_redirected_to '/users/2/edit'

    end

    user = User.find(2)

    assert Redmine::PasswordHash::Argon2id.match?(user.hashed_password)

    assert user.check_password?('newpass123')

  end

    Redmine::Configuration.stubs(:[]).with('password_hash_algorithm').returns(nil)

  def test_api_should_accept_http_basic_auth_using_username_and_argon2id_password

    user = User.generate!

    hash_password_with :argon2id, user, 'my_password'

    get '/users/current.xml', headers: credentials(user.login, 'my_password')

    assert_response :ok

  end

  def test_api_should_deny_http_basic_auth_using_username_and_wrong_argon2id_password

    user = User.generate!

    hash_password_with :argon2id, user, 'my_password'

    get '/users/current.xml', headers: credentials(user.login, 'wrong_password')

    assert_response :unauthorized

  end

  def test_api_http_basic_auth_should_rehash_password_with_configured_algorithm

    user = User.generate! do |user|

      user.password = 'my_password'

    end

    Redmine::Configuration.with 'password_hash_algorithm' => 'argon2id' do

      get '/users/current.xml', headers: credentials(user.login, 'my_password')

      assert_response :ok

    end

    assert Redmine::PasswordHash::Argon2id.match?(user.reload.hashed_password)

  end

  def test_add_user_with_argon2id_password

    hash_password_with :argon2id, User.find(1), 'admin'

    Redmine::Configuration.with 'password_hash_algorithm' => 'argon2id' do

      log_user("admin", "admin")

      expire_sudo_mode!

      assert Redmine::PasswordHash::Argon2id.match?(User.find(1).hashed_password)

      user_params = {

        login: "psmith", firstname: "Paul",

        lastname: "Smith", mail: "psmith@somenet.foo",

        language: "en", password: "psmith09",

        password_confirmation: "psmith09"

      }

      post "/users", params: {user: user_params, sudo_password: 'wrong'}

      assert_response :success

      assert_nil User.find_by_login("psmith")

      post "/users", params: {user: user_params, sudo_password: 'admin'}

      assert_response :found

      assert_kind_of User, User.find_by_login("psmith")

    end

  end

  # Stores password of user hashed with the password hash algorithm name,

  # whatever the password_hash_algorithm setting is

  def hash_password_with(name, user, password)

    salt, hashed_password = Redmine::PasswordHash::ALGORITHMS.fetch(name).digest_password(password)

    user.update_columns(salt:, hashed_password:)

  end

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

require_relative '../../../../test_helper'

class Redmine::PasswordHash::Argon2idTest < ActiveSupport::TestCase

  def test_s_digest_password

    salt, hashed_password = Redmine::PasswordHash::Argon2id.digest_password('hello123')

    assert_nil salt

    assert hashed_password.start_with?('$argon2id$')

  end

  def test_s_match_p

    _, hashed_password = Redmine::PasswordHash::Argon2id.digest_password('hello123')

    _, sha1 = Redmine::PasswordHash::Sha1.digest_password('hello123')

    assert Redmine::PasswordHash::Argon2id.match?(hashed_password)

    assert_not Redmine::PasswordHash::Argon2id.match?(sha1)

    assert_not Redmine::PasswordHash::Argon2id.match?('')

    assert_not Redmine::PasswordHash::Argon2id.match?(nil)

  end

  def test_s_verify_password

    _, hashed_password = Redmine::PasswordHash::Argon2id.digest_password('hello123')

    assert Redmine::PasswordHash::Argon2id.verify_password('hello123', nil, hashed_password)

    assert_not Redmine::PasswordHash::Argon2id.verify_password('hello124', nil, hashed_password)

  end

  def test_s_verify_password_should_return_false_with_broken_hash

    assert_not Redmine::PasswordHash::Argon2id.verify_password('hello123', nil, '$argon2id$broken')

  end

end

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

require_relative '../../../../test_helper'

class Redmine::PasswordHash::Sha1Test < ActiveSupport::TestCase

  def test_s_digest_password

    salt, hashed_password = Redmine::PasswordHash::Sha1.digest_password('hello123')

    assert_match /\A\h{32}\z/, salt

    assert_match /\A\h{40}\z/, hashed_password

  end

  def test_s_match_p

    _, hashed_password = Redmine::PasswordHash::Sha1.digest_password('hello123')

    _, argon2id = Redmine::PasswordHash::Argon2id.digest_password('hello123')

    assert Redmine::PasswordHash::Sha1.match?(hashed_password)

    assert_not Redmine::PasswordHash::Sha1.match?(argon2id)

    assert_not Redmine::PasswordHash::Sha1.match?('')

    assert_not Redmine::PasswordHash::Sha1.match?(nil)

  end

  def test_s_verify_password

    salt, hashed_password = Redmine::PasswordHash::Sha1.digest_password('hello123')

    assert Redmine::PasswordHash::Sha1.verify_password('hello123', salt, hashed_password)

    assert_not Redmine::PasswordHash::Sha1.verify_password('hello124', salt, hashed_password)

  end

end

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

require_relative '../../../test_helper'

class Redmine::PasswordHashTest < ActiveSupport::TestCase

  def test_s_current_algorithm_should_return_configured_algorithm

    Redmine::Configuration.with 'password_hash_algorithm' => 'sha1' do

      assert_equal Redmine::PasswordHash::Sha1, Redmine::PasswordHash.current_algorithm

    end

    Redmine::Configuration.with 'password_hash_algorithm' => 'argon2id' do

      assert_equal Redmine::PasswordHash::Argon2id, Redmine::PasswordHash.current_algorithm

    end

  end

  def test_s_current_algorithm_should_return_sha1_by_default

    Redmine::Configuration.with 'password_hash_algorithm' => nil do

      assert_equal Redmine::PasswordHash::Sha1, Redmine::PasswordHash.current_algorithm

    end

  end

  def test_s_current_algorithm_should_raise_error_with_unsupported_algorithm

    Redmine::Configuration.with 'password_hash_algorithm' => 'md5' do

      error = assert_raise ArgumentError do

        Redmine::PasswordHash.current_algorithm

      end

      assert_equal 'Unsupported password hash algorithm: name=md5', error.message

    end

  end

  def test_s_algorithm_for

    _, sha1 = Redmine::PasswordHash::Sha1.digest_password('hello123')

    _, argon2id = Redmine::PasswordHash::Argon2id.digest_password('hello123')

    %w[sha1 argon2id].each do |name|

      Redmine::Configuration.with 'password_hash_algorithm' => name do

        assert_equal Redmine::PasswordHash::Sha1, Redmine::PasswordHash.algorithm_for(sha1)

        assert_equal Redmine::PasswordHash::Argon2id, Redmine::PasswordHash.algorithm_for(argon2id)

      end

    end

  end

  def test_s_algorithm_for_should_return_nil_with_unknown_hash

    assert_nil Redmine::PasswordHash.algorithm_for('')

    assert_nil Redmine::PasswordHash.algorithm_for(nil)

    assert_nil Redmine::PasswordHash.algorithm_for('$2a$12$unknown')

  end

end

  def test_password_with_argon2id

    Redmine::Configuration.with 'password_hash_algorithm' => 'argon2id' do

      user = User.find(1)

      user.password = "hello123"

      user.save!

      user.reload

      assert user.hashed_password.start_with?('$argon2id$')

      assert_nil user.salt

      assert user.check_password?("hello123")

      assert_not user.check_password?("hello124")

      assert_not user.password_hash_outdated?

      assert_equal user, User.try_to_login("admin", "hello123")

      assert_nil User.try_to_login("admin", "hello124")

    end

  end

  def test_argon2id_password_should_be_verified_when_algorithm_is_sha1

    user = User.find(1)

    Redmine::Configuration.with 'password_hash_algorithm' => 'argon2id' do

      user.password = "hello123"

      user.save!

    end

    Redmine::Configuration.with 'password_hash_algorithm' => 'sha1' do

      user.reload

      assert user.check_password?("hello123")

      assert user.password_hash_outdated?

    end

  end

  def test_try_to_login_should_rehash_sha1_password_with_argon2id

    user = User.find(1)

    token = Token.create!(user:, action: 'autologin')

    passwd_changed_on = 1.day.ago.change(usec: 0)

    user.update_column(:passwd_changed_on, passwd_changed_on)

    Redmine::Configuration.with 'password_hash_algorithm' => 'argon2id' do

      assert_equal user, User.try_to_login("admin", "admin")

      user.reload

      assert user.hashed_password.start_with?('$argon2id$')

      assert_nil user.salt

      assert_equal passwd_changed_on, user.passwd_changed_on

      assert Token.exists?(token.id)

      assert_equal user, User.try_to_login("admin", "admin")

    end

  end

  def test_try_to_login_should_rehash_argon2id_password_with_sha1

    user = User.find(1)

    Redmine::Configuration.with 'password_hash_algorithm' => 'argon2id' do

      user.password = "hello123"

      user.save!

    end

    Redmine::Configuration.with 'password_hash_algorithm' => 'sha1' do

      assert_equal user, User.try_to_login("admin", "hello123")

      user.reload

      assert_match /\A\h{40}\z/, user.hashed_password

      assert user.salt.present?

      assert_equal user, User.try_to_login("admin", "hello123")

    end

  end

  def test_check_password_should_return_false_without_hashed_password

    user = User.find(1)

    user.hashed_password = ''

    assert_not user.check_password?('admin')

    assert_not user.check_password?('')

  end

  def test_check_password_should_return_false_with_unknown_hashed_password

    user = User.find(1)

    user.hashed_password = '$2a$12$unknown'

    assert_not user.check_password?('admin')

  end

  def test_try_to_login_should_return_nil_without_hashed_password

    User.find(1).update_columns(hashed_password: '')

    assert_nil User.try_to_login('admin', 'admin')

  end

  def test_password_hash_outdated_p_should_return_false_without_hashed_password

    user = User.find(1)

    user.hashed_password = ''

    Redmine::Configuration.with 'password_hash_algorithm' => 'argon2id' do

      assert_not user.password_hash_outdated?

    end

  end

  def test_password_hash_outdated_p_should_return_false_with_auth_source

    user = User.find(1)

    user.auth_source_id = 1

    Redmine::Configuration.with 'password_hash_algorithm' => 'argon2id' do

      assert_not user.password_hash_outdated?

    end

  end

  def test_try_to_login_should_not_rehash_password_with_wrong_password

    user = User.find(1)

    Redmine::Configuration.with 'password_hash_algorithm' => 'argon2id' do

      assert_nil User.try_to_login("admin", "wrong")

      assert_equal user.hashed_password, user.reload.hashed_password

    end

  end